What Does It Take to Detect an AI Agent? Minimal Feature Sets for Behavioral Detection under Browser Automation

2026-07-29

AI Summary

This study addresses a critical limitation in existing binary bot detectors, which fail to distinguish traffic generated by AI agents based on browser automation from that of humans or traditional bots. To resolve this, the work proposes the first ternary classification framework explicitly differentiating human users, traditional bots, and AI agents, thereby exposing the systematic misclassification of AI agents by conventional binary models. Leveraging browser automation behavioral features—such as mouse_event_rate and teleport_click_ratio—and combining MLP, SAINT, and large-scale GBM-based feature subset search, the approach achieves 100% recall for AI agents using only two features. Under five levels of evasion attacks (22,990 predictions), it attains zero false negatives, with a precision of 0.994 for the two-feature combination and a macro F1-score of at least 0.99 when using five features.

Abstract

Bot detectors deployed at scale treat traffic as binary: human or bot. This assumption breaks when AI agents browse the web through browser automation, a traffic class that is neither and that binary classifiers structurally cannot represent. We present a three-class detection framework distinguishing humans, bots, and AI agents, and show that the binary-vs-agent confusion is architectural: a binary human-vs-bot detector misroutes agent sessions because its label space lacks an agent class. On our controlled benchmark, an MLP binary classifier misclassifies 39.1% of real AI agents as human and a SAINT binary transformer misclassifies 34.5%; adding an explicit agent class yields per-class agent F1 = 1.000 in all 30 runs (3 model families $\times$ 10 seeds). To measure evasion resistance, we construct a five-level evasion ladder spanning passive observation, GAN-generated trajectories, and replay of real human cursor data ($n = 2299$ evasion sessions). Across 10 seeds and 3 model families we observe zero agent misses in 22990 per-seed predictions. The discriminative signal is a browser-automation artifact, not evidence of agent reasoning: Playwright does not emit the raw pointer-move and wheel-delta streams a physical input device produces, and this absence signature survives trajectory manipulation. Exhaustive search over all feature subsets of size 1-5 (9401 GBMs) shows that two behavioral features (mouse_event_rate, teleport_click_ratio) give 100% observed agent recall at every evasion level with agent precision 0.994; five features lift macro-F1 to 0.991. The signal is redundantly encoded: removing teleport_click_ratio leaves agent detection at 100%. The single-feature regime is degenerate, flagging every agent only by collapsing the classifier to always predict "agent". Two features robustly isolate agents; five separate all three traffic classes at macro-F1 $\geq 0.99$.

Problem

• AI agent detection
• browser automation
• bot detection
• behavioral classification
• three-class traffic

Innovation

• AI agent detection
• browser automation
• three-class classification
• behavioral features
• evasion resistance